T09 · Insecure Skill Coding Practices
Warning
- Location
- templates/TOOLS.md:10
- Finding
- Plaintext API Key Storage Encouraged in Agent Workspace<![CDATA[ ## Vulnerability Details **File Location**: `templates/TOOLS.md`, lines 10–12 **Vulnerability Type**: Plaintext sensitive-data storage **Risk Level**: Medium ### Vulnerable Code ```markdown ## 特殊配置 {记录环境特定的配置、API key 等} ``` The placeholder instructs users to record environment-specific configuration, including API keys, in the generated `TOOLS.md` file. ### Technical Analysis The template encourages credentials to be stored directly in an Agent workspace document. Such files may be automatically loaded into model context, accessed by Agent tools, included in logs or diagnostic output, copied into backups, or accidentally committed to source control. This design unnecessarily exposes credentials to every component or person capable of reading the workspace. It also prevents effective secret scoping and rotation because the credential becomes persistent plaintext rather than a reference to a protected secret source. The project contains no evidence of automatic credential exfiltration. The vulnerability is the unsafe secret-storage guidance and the resulting opportunity for later disclosure. ### Attack Path 1. A user creates an Agent using the provided templates. 2. Following the template guidance, the user inserts an API key into `TOOLS.md`. 3. The generated workspace persists the credential in plaintext. 4. An Agent, local tool, subprocess, backup service, repository user, or diagnostic process reads or copies the file. 5. The exposed credential is used to access the corresponding external service with the permissions assigned to that key. ### Impact Assessment Exploitation may disclose API credentials and grant access to the services authorized by those credentials. The exact privileges depend on the stored key and may include reading protected data, consuming paid API resources, modifying remote resources, or impersonating the credential owner. The exposure scope includes generated Agent workspaces, model context, logs, backups, sourc ...[truncated 77 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove all guidance suggesting that API key values should be written to `TOOLS.md` or any other Agent instruction file. - Replace the placeholder with instructions to record only environment-variable names or secret-manager references, never secret values. - Store credentials in an operating-system credential store, dedicated secret manager, or access-controlled runtime environment variable. - Grant each Agent only the minimum credential scope required for its duties. - Prevent secret-bearing files from entering model context, logs, backups, and source control. - Add automated secret scanning to the project and generated workspaces. - Document procedures for credential rotation and immediate revocation after accidental disclosure. A safer replacement would be: ```markdown ## Special Configuration Record only environment-variable names or secret-manager identifiers here. Never store API keys, passwords, tokens, or other secret values in this file. ``` ]]>